Security policy flow down system

Abstract

A system and method are provided that distill an organization's information security plan into a detailed and unambiguous security object model. The developed security object model provides a visualization of complex relationships between individual elements and levels that is usable to carry into effect the organization's information security plan. Configuration control and a verifiable level of security compliance are provided through implementation of the organization's information security plan by the developed security object model. The developed security object model is hosted on a computing platform in communication with at least the organization's network to provide information security plan compliance, configuration control and gap analysis in a usable form to the organization.

Description

BACKGROUND[0001]1. Field of the Disclosed Embodiments[0002]This disclosure relates to systems and methods for implementing an automated security policy for an organization, particularly through implementing a semantic model in a formal modeling language such as Unified Modeling Language Model (UML), Web Ontology Language (OWL), Semantic Application Design Language (SADL), a controlled-English language that maps directly into OWL, or any other semantic language capable of capturing the instances, classes, and relationships of the security domain in such a way as to render the model computable.[0003]2. Related Art[0004]The information security of an organization is generally governed at the highest levels by the existence of policies, guidelines and standards. These policies, guidelines and standards are generally provided in written form. One or more individuals in the organization are then tasked with developing information security procedures, requirements and, in many cases, speci...

AI Technical Summary

Benefits of technology

[0014]In view of the above shortfalls in conventional security policy implementations, it would be advantageous to provide a model and a system by which critical elements and relationships in a flow down from security policy to security guidelines to security standards and ultimately to implemented security configurations in a particular security environment could be captured. An objective would be to establish an extensible framework that facilitates further analysis, visualization and verification of the flow down as a reusable tool to ensure that security policies are properly defined, and equally as properly enforced in a manner that is consistently verifiable.

Problems solved by technology

Conventionally, the implementation of information security with an organization is largely human dependent.

In general, there does not exist a comprehensive framework for capturing, for instance, relationships between overarching policy objectives and specific security implementation guidelines.

The lack of a comprehensive framework makes it difficult for the individuals tasked with implementing, overseeing and enforcing information security policy to ensure, with any degree of confidence, that the security infrastructure properly reflects the organization's overall goals and objectives.

This difficulty is exacerbated in the all-too-often occurrence where a change in certain situational factors dictates some shift in the security posture of the organization.

Absent an overarching framework, it is difficult for any individual or group to first visualize, and then analyze, an overall impact of potential changes.

This difficulty becomes even more acute in instances where, for example, security policies are intended to be shared between organizations.

The current manual process, overseen by the specified individual(s) suffers from a number of significant drawbacks in meeting the above objectives.

A very basic difficulty exists in interpretation of the terminology used in preparing and interpreting policies, guidelines, standards, procedures, requirements, and ultimately configurations for the security policy implementations.

Unfortunately, within this task of interpretation, there exists an unavoidable level of semantic ambiguity.

This semantic ambiguity often then leads to differing interpretations of the requirements and the configuration by even a small group of individuals tasked with carrying out the security implementation, or between the individual noted above who is tasked with carrying into effect the security policy today, and that individual's successor.

A result is that a specific change in configuration, update or fix may not be adequately managed network wide.

A reliance on individual humans in the loop further then suffers because there is incomplete, if any, detailed turnover from one individual to the next regarding a specific interpretation of what a particular term in a particular security configuration entails.

Simply put, different individuals, without detailed guidance, which is often non-existent, will likely interpret a large number of terms in a security policy implementation in different ways leading to potentially vast differences in implementation of the security policy.

Significant difficulties are then encountered in verification of the security policy implementation as those metrics are then themselves open to broad interpretation.

Even with that expert intuition, however, a measurable level of consistency in the manual process remains largely unachievable.

For the above reasons, security policy implementations within organizations, or across organizational lines where required, end up being subject to significant interpretation leading to wide variability in carrying out security policies.

If room existed for interpretation of a specification for a manufactured article, it is likely that unacceptable variations in the manufactured article would be introduced.

In like manner, in the case of automated inventory control, if there were room for interpretation, inventory management would quickly suffer.

Images